<html>
<script type="text/javascript">

    function exploit(attributeName) {
        alert("I win!")
    }

    function installExploit() {
        var body = document.getElementsByTagName("body")[0]
        alert("installing exploit")
        body.hasAttribute = exploit
    }

    function tryIt() {
        alert("tryIt() called)")
        var body = document.getElementsByTagName("body")[0]
        var hasId = body.hasAttribute("id")
        alert("hasId is "+hasId);
    }

</script>
<body onload="installExploit()">
<p>Hello!</p>
<button onclick="tryIt()">Try It</button>
</body>
</html>